Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ecbe6d01 authored by Zhang Shurong's avatar Zhang Shurong Committed by Greg Kroah-Hartman
Browse files

media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() 



[ Upstream commit 5ae544d94abc8ff77b1b9bf8774def3fa5689b5b ]

In dw2102_i2c_transfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach dw2102_i2c_transfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.

Similar commit:
commit 950e252c
("[media] dw2102: limit messages to buffer size")

Signed-off-by: default avatarZhang Shurong <zhang_shurong@foxmail.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent fa58d9db

drivers/media/usb/dvb-usb/dw2102.c

+24 −0
Original line number Diff line number Diff line
@@ -131,6 +131,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], 


	switch (num) {

	case 2:

		if (msg[0].len < 1) {

			num = -EOPNOTSUPP;

			break;

		}

		/* read stv0299 register */

		value = msg[0].buf[0];/* register */

		for (i = 0; i < msg[1].len; i++) {
@@ -142,6 +146,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], 
	case 1:

		switch (msg[0].addr) {

		case 0x68:

			if (msg[0].len < 2) {

				num = -EOPNOTSUPP;

				break;

			}

			/* write to stv0299 register */

			buf6[0] = 0x2a;

			buf6[1] = msg[0].buf[0];
@@ -151,6 +159,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], 
			break;

		case 0x60:

			if (msg[0].flags == 0) {

				if (msg[0].len < 4) {

					num = -EOPNOTSUPP;

					break;

				}

			/* write to tuner pll */

				buf6[0] = 0x2c;

				buf6[1] = 5;
@@ -162,6 +174,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], 
				dw210x_op_rw(d->udev, 0xb2, 0, 0,

						buf6, 7, DW210X_WRITE_MSG);

			} else {

				if (msg[0].len < 1) {

					num = -EOPNOTSUPP;

					break;

				}

			/* read from tuner */

				dw210x_op_rw(d->udev, 0xb5, 0, 0,

						buf6, 1, DW210X_READ_MSG);
@@ -169,12 +185,20 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], 
			}

			break;

		case (DW2102_RC_QUERY):

			if (msg[0].len < 2) {

				num = -EOPNOTSUPP;

				break;

			}

			dw210x_op_rw(d->udev, 0xb8, 0, 0,

					buf6, 2, DW210X_READ_MSG);

			msg[0].buf[0] = buf6[0];

			msg[0].buf[1] = buf6[1];

			break;

		case (DW2102_VOLTAGE_CTRL):

			if (msg[0].len < 1) {

				num = -EOPNOTSUPP;

				break;

			}

			buf6[0] = 0x30;

			buf6[1] = msg[0].buf[0];

			dw210x_op_rw(d->udev, 0xb2, 0, 0,